chore(deps): update module github.com/goccy/go-json to v0.10.6

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/goccy/go-json	v0.10.5 → v0.10.6

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

goccy/go-json (github.com/goccy/go-json)

v0.10.6: 0.10.6

Compare Source

What's Changed

• fix: panic on embedded struct with recursive by @​NgoKimPhu in #​483

New Contributors

• @​NgoKimPhu made their first contribution in #​483

Full Changelog: goccy/go-json@v0.10.5...v0.10.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/go.sum

Command failed: go get -t ./...
go: downloading github.com/goccy/go-json v0.10.6
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/context: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/context
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/dal: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/dal
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/log: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/log
go: github.com/apache/incubator-devlake/helpers/unithelper imports
	github.com/apache/incubator-devlake/mocks/core/plugin: cannot find module providing package github.com/apache/incubator-devlake/mocks/core/plugin
go: github.com/apache/incubator-devlake/helpers/pluginhelper/api tested by
	github.com/apache/incubator-devlake/helpers/pluginhelper/api.test imports
	github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api: cannot find module providing package github.com/apache/incubator-devlake/mocks/helpers/pluginhelper/api
go: module github.com/aws/aws-sdk-go is deprecated: aws-sdk-go is deprecated. Use aws-sdk-go-v2.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:15 PM UTC · Completed 10:21 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Review — PR #28

Verdict: ✅ Approve

Summary

Automated patch version bump of an indirect dependency: github.com/goccy/go-json v0.10.5 → v0.10.6 in backend/go.mod.

The upstream v0.10.6 release contains a single bug fix — resolving a panic on embedded structs with recursive definitions (goccy/go-json#483). This is a safe, minimal patch bump.

Dimensions

Dimension	Result	Notes
Correctness	✅ Pass	Patch version bump of indirect dep; no logic changes in this repo
Security	✅ Pass	No security implications — JSON parsing library bug fix
Intent & coherence	✅ Pass	Automated MintMaker dependency update, properly scoped
Style/conventions	✅ Pass	Standard go.mod format
Documentation	✅ Pass	No documentation changes needed
Cross-repo contracts	✅ Pass	No API or schema changes

Notes

• The PR only updates go.mod; go.sum will be updated when go mod tidy runs (standard behavior for MintMaker/Renovate bots).
• The upstream change is a targeted panic fix with no breaking changes, consistent with a patch version bump.

Previous run (2)

Looks good to me

Previous run (3)

Review

Findings

High

• [error handling gaps] backend/go.sum — The PR updates github.com/goccy/go-json from v0.10.2 to v0.10.6 in go.mod, but go.sum is not included in the changed files. The go.sum file contains only v0.10.2 checksum entries. Without the corresponding v0.10.6 checksum entries in go.sum, go build will fail with a missing checksum error, making this change non-buildable as submitted.
  Remediation: Run go mod tidy inside the backend/ directory and commit the resulting go.sum changes alongside go.mod.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:54 AM UTC · Completed 2:00 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-retro]

Retro: PR #28 — Autoclosed Renovate dependency bump

What happened: PR #28 was an automated Renovate bot PR updating github.com/goccy/go-json from v0.10.2 to v0.10.6. It only modified go.mod without updating go.sum, which Renovate itself flagged as an artifact failure on 2025-11-08. The PR sat untouched for ~8 months with zero human engagement. On 2026-06-25, the fullsend review agent ran (review run 28203771680) and correctly identified the missing go.sum checksums as a HIGH finding — but this was redundant with Renovate's own warning from 7 months earlier. The PR was autoclosed on 2026-07-05, triggering this retro.

Assessment: The review agent's finding was technically correct, but the entire review cycle was wasted effort — the PR was abandoned, the issue was already known, and no human was ever going to act on it. The retro dispatch on the autoclosed bot PR is similarly low-value.

All improvement areas are already tracked upstream:

• #1371 — Skip review dispatch for bot-authored PRs
• #1406 — Review agent should weigh bot warning comments on dependency PRs
• #2461 — Skip retro dispatch for autoclosed bot-authored PRs
• #2586 — Review agent should recommend closing unfixable dependency-bot PRs
• #2863 — Add stale bot PR detection to auto-close PRs with prolonged CI failure
• #664 — Incorporate existing human and bot reviews into assessment

No new proposals needed — existing issues comprehensively cover the improvements this workflow surfaces. Prioritizing apache#1371 and apache#2461 would eliminate the most waste for this class of PR.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:41 AM UTC · Completed 9:45 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:35 PM UTC · Completed 8:38 PM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:04 PM UTC · Completed 5:10 PM UTC
Commit: 701e62a · View workflow run →